Comment by riffraff

If catching "all" security issues becomes feasible then the balance tilts in favor of the projects vs the attackers.

Big malicious entities always had more investments in this than random open source projects.